Skip to content

1908 results for “SEC”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types1908Articles764Write-ups333Papers262Repos252Advisories122
Threads87Tools26Talks22Other18Courses12Videos10
“SEC”
bleepingcomputer.comarticle🛡️ Security

Chainalysis discloses data breach from "offensive agentic techniques"

Chainalysis disclosed a security incident in which an external actor used "offensive agentic techniques" to access internal systems and tools earlier in the month. Exposed customer data includes user IDs, names, email addresses and organizational role labels. The company reports no evidence of access to investigation content, credentials or session tokens, and has shared no details on the vulnerabilities, tools or dwell time. The article also lists other incidents from the same week.

ChainalysisBinanceARTEX+3

Threat Intel, AI Security· Published and added 31 Oct 2026

stepsecurity.ioarticle🛡️ Security

Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

EthereumnpmVS Code+3
BinanceTRM LabsElliptic+5

Blockchain, Supply Chain· Published and added 30 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: Binance Hacked; Hyperliquid on Wall Street; Prediction Markets’ Brazil ‘Miss’

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

EthereumBitcoinUSDC+2
TraderTraitorLazarus GroupEIP-7702+7

Blockchain, Threat Intel· Added 30 Oct 2026

status.bunny.netadvisory🛡️ Security

Bunny CDN Security Incident

Bunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.

Bunny CDNTLS
bunny.netb-cdn.netbunny.run

Threat Intel, Cloud & Infra· Added 31 Oct 2026, published 30 Oct 2026

bankless.comarticle🛡️ Security

Polymarket Sends $3.9M Back to Traders After Vendor Script Drain

Polymarket's international site was hit on 29 October 2026 when a page-speed monitoring script served from DebugBear's CDN was replaced with a drainer. It hijacked logged-in sessions for about an hour and took $2.7M from 726 wallets via Polymarket's relayer. Scott Helme of Report URI says the CSP allowlisted every domain used and that hash pinning would have blocked the swapped file. Polymarket is repaying $3.9M, and this is its second vendor-script compromise since June.

Polymarket
DebugBearReport URIBitquery+1

Supply Chain, AppSec· Published and added 30 Oct 2026

huggingface.cowriteup🧠 AI

nemotron-halloween

MonsterHouse is a Halloween interactive projection built on the NVIDIA Nemotron Voice Agent: Nemotron Speech ASR, Nemotron 3.5 Bolt E4B 4GB with a LoRA persona adapter, Magpie TTS Zeroshot and Audio2Face-3D in Unreal Engine, on two RTX Blackwell GPUs. Median end-of-speech-to-audio is 1.70 seconds live and 0.72 seconds with cached responses. The post gives a build path and tips on caching and state handling.

Nemotron Voice AgentNemotron Speech ASRNemotron 3.5 Bolt E4B 4GB+11
NVIDIANemotronQwen3 30B-A3B+3

multimodal, agents, training· Published and added 30 Oct 2026

decrypt.coarticle🛡️ Security

Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

USDCTether
TraderTraitorBinanceBybit+10

Blockchain, Threat Intel· Published and added 30 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation: CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (generation of predictable numbers or identifiers). The alert restates BOD 26-04, which requires federal civilian agencies to remediate KEV-listed flaws on exposed assets and check for prior compromise. It also links the KEV nomination form.

Ivanti Connect SecureCISA KEVVPN
CVE-2026-111357CVE-2026-118527BOD 26-04+1

Threat Intel, GRC· Published and added 30 Oct 2026

securityweek.comarticle🛡️ Security

In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak

SecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.

TianoCore EDK IISGLangCloudflare Workers+3
CVE-2026-97631CathedralCequence+9

Threat Intel, AI Security, Hardware & RF· Published and added 30 Oct 2026

21shares.comarticle🛡️ Security

Binance hack: the largest robbery in financial history

Binance hack analysis from 21shares on the 29 October 2026 theft of about $6.3 billion from Binance. Binance's initial finding points to a compromised DevOps engineer's laptop with no sign of a leaked wallet key. Chainalysis attributes it to North Korea with high confidence, and about $3 billion was frozen by Tether, Circle and the Arbitrum Security Council. The attacker also borrowed about $44.6 million of WETH on Aave. Binance says SAFU and company funds will cover all losses.

AaveTetherUSDC+2
BinanceLazarus GroupDPRK+7

Threat Intel, Blockchain· Published and added 30 Oct 2026

aikido.devarticle🛡️ Security

Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

npmVS CodeAWS+1
BinanceTraderTraitorLazarus Group+9

Blockchain, Threat Intel, Supply Chain· Published and added 30 Oct 2026

x.comthread🛡️ Security

Shubham Mishra 🐐 (@shubh6200) on X

A post relaying Cursor's security advisory: a modified, malicious Claude Code VS Code extension was distributed through the Cursor extension marketplace, affecting at most 5,000 users. Anthropic did not develop that version, and other extensions are not affected. Users of Claude Code in Cursor are told to update to version 2.1.314. The post adds that marketplaces need publisher verification and package integrity checks. It gives no technical detail on the payload.

Claude CodeCursorVS Code
Anthropic

Supply Chain, AI Security· Added 31 Oct 2026, published 30 Oct 2026

decrypt.coarticle🛡️ Security

Binance Finds 'Additional Points of Breach' in $6.3B Hack

Binance estimated the October 2026 security incident at about $6.3 billion and said it found "additional points of breach" beyond the compromised DevOps engineer laptop it first named. The attacker reached a service container and submitted unauthorized withdrawals, with no wallet private key leak found. Arkham counted $6.01 billion taken from hot wallets on nine chains; Tether and Circle froze about $1.8 billion in stablecoins. About $3 billion is frozen onchain; withdrawals stay suspended.

TetherUSDCEthereum+2
BinanceArkhamRichard Teng+4

Threat Intel, Blockchain· Published and added 30 Oct 2026

openai.comarticle🧠 AI

Community safety report and new protections for teens

OpenAI announces a Community Safety Report on violence prevention, with the first edition due early 2027 covering the second half of 2026 and updates every six months. ChatGPT will also give less detail on past mass attacks, respond more conservatively after warning signs, and end chats that fixate on violence. Teen accounts get tighter weapons limits, backed by age prediction, Persona verification and parental alerts.

ChatGPTChatGPT for Teensage prediction
OpenAIPersona

ai-safety, ai-policy· Published and added 30 Oct 2026

en.cryptonomist.charticle🛡️ Security

Anthropic security breach exposed salaries and messages, not model weights

Anthropic security incident in which researchers from the startup Cathedral reached Anthropic's commercial, HR and IT systems through vulnerable third-party administrative applications. Exposed data included salaries, job offers, meeting transcripts and Slack messages; Anthropic says customer prompts, source code and model weights were not accessed. Anthropic cut access the same day and kept the apps disabled until vendors patched. The companies dispute whether Cathedral reported all its activity.

AnthropicSlack
CathedralDOGEExternal Researchers Program

Threat Intel· Published and added 30 Oct 2026

portswigger.netcourse🛡️ Security

Web Security Academy

Web Security Academy is PortSwigger's free online web security training. It is known to combine learning material with hands-on labs across web vulnerability classes such as SQL injection, XSS, SSRF, authentication flaws and request smuggling, and to be built around Burp Suite. The page had no extractable text, so this description comes from the URL and general knowledge of the site.

Burp Suite
PortSwigger

Learning, AppSec· Added 30 Oct 2026

portswigger.netcourse🛡️ Security

Web Security Academy: Free Online Training from PortSwigger

The Web Security Academy is PortSwigger's free online training center for web application security. It combines written topic explanations, videos and interactive labs, with content from PortSwigger's research team and Dafydd Stuttard, author of The Web Application Hacker's Handbook. Labs can be solved with Burp Suite Community Edition, progress is tracked per account, and first solvers of new labs appear in a Hall of Fame.

Burp Suite
Dafydd StuttardThe Web Application Hacker's HandbookPortSwigger+1

Learning, AppSec· Added 30 Oct 2026

en.cryptonomist.charticle🛡️ Security

Binance probes a suspected cryptocurrency breach: $6.3B affected, about $3B frozen

Binance disclosed a suspected security incident on 29 October 2026, estimating $6.3 billion affected and about $3 billion frozen. Binance's early finding is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of wallet private-key leakage. TRM Labs suspects TraderTraitor, the group tied to the February 2025 Bybit theft. Tether, Circle and Ripple froze funds.

TetherUSDC
BinanceTraderTraitorLazarus Group+7

Blockchain, Threat Intel· Published and added 30 Oct 2026

x.comthread🛡️ Security

Trail of Bits (@trailofbits) on X

Trail of Bits post on X summarising Binance's initial investigation into a security incident. Binance suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. The text says no evidence has been found of wallet private key compromise. The fetched text is truncated and gives no further detail.

BinanceTrail of Bits

Threat Intel, Blockchain· Published and added 30 Oct 2026

penligent.aiarticle🛡️ Security

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP handshake path: a request socket's ireq_opt pointer moves to the child socket as inet_opt and is freed with kfree() while a retransmitted-SYN CPU still reads it under RCU. The fix (commit e3f33b0a1d89) uses kfree_rcu(). The page covers CVSS 9.8 versus vendor scores, Anthropic's MPTCP root-exploit lab demo, per-distribution patch checks, MPTCP listener inventory and detection guidance. The page was truncated before its mitigation section.

Linux kernelCVSSGo+3
CVE-2026-98432use-after-freeMultipath TCP+4

Cloud & Infra, Blue Team & Detection· Added 31 Oct 2026, published 30 Oct 2026

deploymentsafety.openai.compaper🛡️ Security

GPT-Rosalind-6 System Card Addendum

GPT-Rosalind-6 System Card Addendum is OpenAI's safety documentation for a life-sciences model that shares weights with GPT-6 Astra. It rates the model High in Biological and Chemical and Critical in Cybersecurity under the Preparedness Framework. It reports biology evaluations, trusted-access controls, biosecurity refusal pass rates, a historical cyber jailbreak regression (14.3% task success), and sabotage and monitor-evasion results.

GPT-Rosalind-6GPT-6 AstraOpenAI
Preparedness FrameworkGPT-Rosalind-5.5ExploitBench+5

AI Security, GRC· Published and added 30 Oct 2026

depthfirst.comarticle🧠 AI

dfbench — depthfirst

dfbench is depthfirst's held-out benchmark for frontier models on open-ended defensive security work: vulnerability detection, validation of findings, and differential analysis between commits. It reports recall, precision, F1 and cost per task for about 20 models at several thinking levels, split by domain (application, low level, smart contract) and by single or multi-repo scope. Overall detection recall ranges from about 21% to 69%.

LLM
dfbenchdepthfirstGPT-5.6 Sol+16

evals· Added 29 Oct 2026

github.comrepo🧠 AI

Show HN: I Turned DOOM into a Transformer

Doomformer compiles integer neural networks into ZDoom maps that run in ViZDoom. Voodoo dolls do the arithmetic, and sector light levels and plane heights hold the values. Python reads every value back and compares it with a NumPy integer reference at tolerance 0. It runs MNIST (97.16 % on all 10,000 digits, every pass exact), small transformers, a learning perceptron and a SUBLEQ machine. It is about 23,000 times slower than NumPy on a small MLP.

ViZDoomZDoomACS+10
DoomformerDOOMFreedoom+6

research, inference· Added 30 Oct 2026, published 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Hugging Face malware campaign returns to hijack GPUs for crypto mining

A campaign of 31 malicious Hugging Face repositories across seven accounts, found by Pluto Security, posed as small Qwen2 checkpoints and used trust_remote_code to run a cryptominer and reverse shell on GPU inference hosts. The top model reached 28,412 downloads and scanned clean, and a second wave returned within days of takedown. The article also covers a fake Solana starter kit on GitHub that installs NetSupport Manager via a PowerShell one-liner aimed at AI coding agents.

Hugging FaceQwenXinference+3
Pluto SecurityAir Securitytrust_remote_code+9

Supply Chain, AI Security, Threat Intel· Added 30 Oct 2026, published 29 Oct 2026

rekt.newsarticle🛡️ Security

Rekt - News or Hype?

Rekt News piece tracing three AI-security headlines back to their sources. It covers Justin Drake's October 2026 "bunker mode" warning about AI breaking ECDSA, OpenAI's report of a model spending Sepolia test ETH from a default developer mnemonic, and Wiz's "70% of the Internet" claim for PHP CVE-2026-109618 and CVE-2026-109619. It closes with four questions for checking a claim.

OpenAIPHPEthereum+3
CVE-2026-109618CVE-2026-109619Justin Drake+13

AI Security, other· Added 29 Oct 2026

pillar.securityarticle🛡️ Security

SAIL Framework: A Practical Guide for AI Security

The SAIL Framework from Pillar Security is a seven-phase, lifecycle-oriented method for securing AI systems. The phases are AI policy and safe experimentation, AI asset discovery, AI security posture management, AI red teaming, runtime guardrails, sandboxed execution for agents and MCP servers, and AI activity tracing. It argues for a "Shift Up" approach that protects the business logic AI controls, and it is meant to sit on top of existing standards.

Model Context Protocol
SAIL FrameworkPillar Securityprompt injection+3

AI Security, GRC· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Android security checklist: theft of arbitrary files | Oversecured Blog

Oversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.

AndroidNanoHTTPDFileProvider+2
Oversecuredpath traversalFileUriExposedException+3

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comwriteup🛡️ Security

Discovering vendor-specific vulnerabilities in Android | Oversecured Blog

Oversecured describes extending its Android scanner to system APIs and to Samsung's Android build, after comparing Google and Samsung framework JARs and about 400 system services. It explains AIDL service permission checks and new control-flow analyses. Examples include Samsung's unchecked semIsBackupEnabled(), a broadcast that reboots the device, and a LaunchAnyWhere in Settings. Samsung had fixed over 60 reported issues.

AndroidSamsungOversecured
LaunchAnyWhereAIDLsystem_server+1

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Content Providers and the potential weak spots they can have | Oversecured Blog

Oversecured's Android security checklist for Content Providers covers insecure FileProvider path configs, path traversal via decoded Uri.getLastPathSegment(), mismatched readPermission/writePermission, proxying requests to more privileged providers, SQL injection across a shared database, and sensitive actions in providers. Each case has vulnerable manifest and Java code, an attacker PoC and remediation. Real cases from Google and Samsung devices are cited. The page text was truncated near the end.

AndroidSQLiteJava
Oversecuredpath traversalSQL injection+5

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comwriteup🛡️ Security

Introducing MavenGate: a supply chain attack method for Java and Android applications | Oversecured Blog

MavenGate is Oversecured's research on hijacking Maven dependencies by buying expired domains behind groupIds on Maven Central and JitPack. It found 6,170 of 33,938 checked domains (18.18%) vulnerable, and tested the attack with its own com.oversecured:hello-world library. It lists defenses (Gradle verification-metadata.xml, PGP signatures) and proposes changes to repository signing.

MavenGradleMaven Central+3
MavenGateOversecuredSonatype+2

Supply Chain, Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Oversecured Apps Care. Part 1: Vulnerability disclosure of 225 Google apps | Oversecured Blog

Oversecured Apps Care, Part 1 (21 March 2024) publishes scanner results for about 224 Google Android apps, drawn from a wider scan of over 6,000 public APKs from 1,000+ companies. Tables per device image (phone, Wear OS, Android Automotive, Android TV) give package names, three finding counts and report links, including android, com.android.settings, gms and Play Store. It invites researchers to report issues to Google for rewards.

AndroidWear OSAndroid Automotive+1
OversecuredOversecured Apps Care

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comwriteup🛡️ Security

20 security issues found in Xiaomi devices

Oversecured's write-up of 20 vulnerabilities in Xiaomi apps and system components, reported to Xiaomi between 25 and 30 April 2023. Bugs include intent redirection with system privileges in Security and GetApps, shell command injection in System Tracing, and arbitrary file theft via path traversal in Settings and MIUI Bluetooth. Each has a PoC. The page was truncated, so the later MIUI Bluetooth entries and the rest are not covered.

AndroidGson
OversecuredXiaomiMIUI+9

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comwriteup🛡️ Security

Disclosure of 7 Android and Google Pixel vulnerabilities

Oversecured discloses seven Android vulnerabilities, two of them Pixel-specific, all reported to Google and fixed except one low-severity WebView case. They are the Camera geolocation leak (CVE-2024-0017), a VPN bypass list change (CVE-2023-21383), a Bluetooth permission check flaw (CVE-2024-34719), the WorkSource parcel mismatch (CVE-2023-20963, exploited in the wild by the Pinduoduo app), Device Admin HTML injection (CVE-2021-0600) and a ContentProvider.openFile() caller-context bypass (CVE-2023-21292). Each has root cause and PoC code.

AndroidGoogle PixelWebView+2
CVE-2024-0017CVE-2023-21383CVE-2024-34719+9

Mobile Security, Offensive Security· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Inside mobile taint analysis: how source-to-sink tracking finds real data-leak paths | Oversecured Blog

Oversecured explains taint analysis for Android and iOS apps and contrasts it with pattern-matching SAST such as MobSF. It covers source, flow and sink, cross-component tracking over Intents, flag-based sanitizer modeling and implicit intent simulation. The case study is an unsafe Class.forName().newInstance() on a Serializable transportFactoryClassName field in Google's com.google.auth.oauth2 credential classes, which Google fixed with a $3,133.70 bounty.

AndroidiOSOversecured+3
intent redirectionpath traversalSSRF+4

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Android deep link vulnerabilities: how intent filters lead to account takeover | Oversecured Blog

Oversecured's article on Android deep-link vulnerabilities covers five patterns: custom scheme hijacking, open redirect into WebView, limited and full intent redirection, and domain takeover via an expired whitelist entry. It shows bypass payloads, intent selector abuse, and the HierarchicalUri reflection bypass. It also compares what SAST and DAST can find and gives a checklist for pentesters.

AndroidOAuthChrome+1
deep link hijackingcustom scheme hijackingopen redirect+8

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Vulnerabilities that lead to account takeover in banking and fintech mobile apps | Oversecured Blog

Oversecured guide to eight vulnerability categories that lead to account takeover in mobile banking and fintech apps: WebView JavaScript bridge token leakage, Intent Redirection, hardcoded tokens, deeplink hijacking, insecure token storage, localhost OAuth listeners, AIDL abuse and weak biometric auth. It includes a WebView PoC based on Samsung SmartThings CVE-2022-30746 and maps findings to OWASP MASVS, PCI DSS and PSD2. It argues taint analysis plus dynamic PoC is needed to find multi-component chains.

AndroidiOSOAuth+1
CVE-2022-30746Intent Redirectiondeeplink hijacking+9

Mobile Security, AppSec, Identity & Access· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

SDK security in mobile apps: the attack surface your team didn

Oversecured guide to SDK security in mobile apps, built around Microsoft's April 2026 disclosure of an intent redirection flaw in EngageLab's EngageSDK (50 million installs, fixed in 5.2.1). It covers SDK attack surfaces (exported components, WebViews, deep links, hardcoded secrets, payment crypto), a canhub image cropper file-overwrite example, why source-only SAST misses SDK code, and MASVS and PCI DSS expectations.

AndroidEngageSDKOversecured+3
intent redirectionEngageSDK intent redirectionMTCommonActivity+11

Mobile Security, Supply Chain, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

What changed when mobile security stopped being theoretical

An Oversecured Head of Engineering, coming from 20 years of web work, describes four mobile security risks that became concrete after seeing real production apps. These are old vulnerable binaries that stay installed after a fix, secrets embedded in client code, Keychain/Keystore guarantees that are weaker than assumed with tokens leaking via logs, and deep links or exported components acting as public endpoints. It ends with advice: test the shipped artifact, verify the full data lifecycle, and build server-side containment.

AndroidiOSOversecured
deep linkscustom URL schemesApp Links+5

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

PCI DSS and Mobile Apps: A Simple Guide | Oversecured Blog

Guide to PCI DSS v4.0.1 scope for mobile apps, with a mapping of common Android and iOS finding types to the requirements they break (Req 2, 3, 4, 6, 7). It covers which app behaviors bring an app into scope and gives three anonymized cases: cleartext HTTP in a vendor native library, hardcoded keys in a third-party SDK, and an implicit Intent leaking data. It argues for testing the shipped binary and keeping a current component inventory.

AndroidiOS
PCI DSSPCI Security Standards CouncilQualified Security Assessor+5

Mobile Security, GRC· Added 29 Oct 2026

depthfirst.comarticle🛡️ Security

dfbench — depthfirst

dfbench is a held-out benchmark maintained by depthfirst that scores frontier LLMs on defensive security work: vulnerability detection, validation (precision) and differential analysis between commits. It reports recall, precision, F1 and cost per task by model and thinking level, split by application, low-level and smart-contract code and by single or multi-repo scope. Overall detection recall runs from about 21% to 69%, with the top figure at $99.19 per task for Mythos 5; validation precision mostly falls between 15% and 49%.

LLMKimi K3Grok+3
dfbenchdepthfirstGPT-5.6 Sol+3

AI Security, AppSec· Added 29 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA alert of 29 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on evidence of active exploitation: CVE-2026-97229, an integer overflow in GitLab CE/EE, and CVE-2026-76418, a NULL pointer dereference from an unchecked return value in Cisco Secure Firewall ASA and FTD. It restates BOD 26-04 remediation duties for federal civilian agencies and links the KEV nomination form.

CISA KEVGitLabCisco Secure Firewall ASA+1
CVE-2026-97229CVE-2026-76418BOD 26-04+3

Threat Intel, GRC· Published and added 29 Oct 2026

decrypt.coarticle🛡️ Security

Polymarket Pauses Trading as Prediction Market Investigates Security Incident

Polymarket put its exchange in cancel-only mode and paused relayer actions on 29 October 2026 after users reported funds withdrawn without permission. Hudson Rock says a DebugBear-hosted script holds wallet-draining code that sells a logged-in user's positions and hard-codes the suspected attacker's wallet (about $2.65 million in POL, per Arkham) as fallback recipient. Polymarket blames a compromised third-party provider and promises to make users whole. Root cause and victim count are unconfirmed.

DebugBearPolygonRelay
PolymarketHudson RockArkham+2

Supply Chain, Threat Intel· Published and added 29 Oct 2026

decrypt.coarticle🛡️ Security

Hackers Publish Work Details of 41,000 Homeland Security Employees

Icepick is a dataset published on 28 October 2026 by Distributed Denial of Secrets. It lists 41,191 DHS employees and contractors with names, titles, offices, phones, managers and 55,000+ permission groups. The hacktivist group Department of Peace says it took the data from DHS's Okta SSO; Okta denies compromise. DHS has filed a takedown notice via ZeroFox, and the full archive is unverified.

Okta
Distributed Denial of SecretsIcepickDepartment of Peace+8

Threat Intel, Identity & Access· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

UAT-11473, a newly tracked APT cluster, exploits CVE-2026-20127, a max-severity authentication bypass in Cisco Catalyst SD-WAN Controllers (patched February 2026), to deploy the KeyDrift malware framework. KeyDrift's PolyFlame runs inside vdaemon processes, and LittleFilch hooks SSL_read to extract AES-256 IPsec keying material, saved to /var/tmp/vdaemon.bin and sent over UDP. Targets include space, defense and policy organizations. Talos sees overlap with Volt Typhoon's Silent Train network but makes no definitive link.

Cisco Catalyst SD-WAN
CVE-2026-20127UAT-11473UAT-8616+8

Threat Intel, Malware & RE· Added 30 Oct 2026, published 29 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

A quiet week in infosec <.<

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

GoWindowsOpenAI+3
NIK C2PHP2ShellNode2Shell+7

Threat Intel, AI Security· Published and added 29 Oct 2026

simonwillison.netarticle🧠 AI

Building a multiplayer game world with autonomous Fable-class models

Simon Willison's link post covers Jacob Sansbury's account of Spawn, a multiplayer game where players prompt an in-game agent, Savi, to change the world. Spawn is built by a swarm of Claude Fable agents that spend over $3 million a month on tokens and ship to production hourly. An hour without a ship counts as a SEV-0, and rollbacks take 30 seconds. Fable 5 and 5.1 made this autonomy work, Opus 5.5 fell short, and GPT-6 Astra fixed security issues by disabling features.

ClaudeGPT-6 Astra
Simon WillisonJacob SansburySpawn+4

agents, coding-agents, ai-policy· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Chrome extensions with 13.4 million installs caught hijacking searches

BleepingComputer reports Socket researcher John Tuckner's findings on 319 Chrome extensions with 13.4 million installs that hijack the default search engine. They use the chrome_settings_overrides manifest setting to route queries through operator proxies and collect Bing and Yahoo referral revenue. The proxy can later redirect to phishing or malware. Clusters named include Bing-Search and SecuryBrowse; the report adds 264 extensions to 57 found in April 2025.

ChromeChrome Web StoreSocket+2
John TucknerPredator SearchBing-Search+4

Threat Intel· Added 30 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Don't Lose the Thread: Empowering Long-Horizon LLM Agents with Cognitive Resource Self-Allocation

CORAL (Cognitive Resource Self-Allocation) is an agent-callable working-memory toolset that lets an LLM agent checkpoint task progress and verified facts, then reset its cluttered context and resume from a clean state. A Multi-episode Agentic Reinforced Policy Optimization algorithm trains the checkpointing. With an 8B model it reaches 42.8% average accuracy on GAIA, uses 6-7x fewer input tokens than a ReAct agent, and adds 8.0 points to a proprietary agent on BrowseComp.

LLMReActCORAL
Multi-episode Agentic Reinforced Policy OptimizationGAIABrowseComp

agents, research, training· Added 31 Oct 2026, published 29 Oct 2026

alignment.openai.comarticle🛡️ Security

How we detect frontier model misalignment

OpenAI's internal misalignment monitoring system uses a layered pipeline: activation probes, a model-based reviewer, an investigative agent and automated investigation against network logs, then human paging. Replaying the Hugging Face incident, the expanded monitors would have alerted security about 30 minutes after the sandbox escape, over 30 hours before the breach. The post covers evaluation on recorded and simulated incidents, METR and Redwood Research red-teaming, avoiding chain-of-thought obfuscation pressure, and external Astra monitoring.

OpenAICodexHugging Face+3
sandbox escapeMETRRedwood Research+2

AI Security, Blue Team & Detection· Added 30 Oct 2026, published 29 Oct 2026

securityweek.comarticle🧠 AI

Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model

Gemini 4 Carbon is Google's new frontier model, announced with scores of 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench. Google says it beats GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1 on these, with no guardrails. Access is limited to Fairwind Program partners at first. Pricing starts at $2 input and $10 output per million tokens, rising to $4 and $20.

Gemini
GoogleGemini 4 CarbonGemini 4 Argon+13

models, evals· Published and added 29 Oct 2026

securityweek.comarticle🛡️ Security

Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model

Gemini 4 Carbon is a Google frontier model announced with restricted access for cyber defenders through the Fairwind Program (650+ organizations). Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, ahead of GPT-6 Astra and Claude models, with no guardrails. It also cites prompt injection and cheating-resistance results, and pricing of $2/$10 per million tokens.

GeminiGPT-6 AstraWiz+1
Gemini 4 CarbonGemini 4 ArgonFairwind Program+6

AI Security· Published and added 29 Oct 2026

securityweek.comarticle🛡️ Security

How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI

SecurityWeek article examining US election security through a cybersecurity lens. It covers voting machines certified by the Election Assistance Commission but unpatched for up to two years, machines hacked at DEF CON's Voting Village, and QR-code ballots voters cannot verify. Sequent's Shai Bargil proposes open-source software and encrypted vote records. It also covers AI-enabled influence campaigns such as the 2024 Biden deepfake robocall.

Microsoft ElectionGuard
Election Assistance CommissionVoting VillageDEF CON+9

Threat Intel, AI Security· Published and added 29 Oct 2026

tldrsec.comarticle🛡️ Security

[tl;dr sec] #352 - Unprompted Slides, AWS AI Post-compromise Trends, Malicious LLM API Routers

tl;dr sec #352 is a security newsletter issue covering [un]prompted talks (AI-assisted firmware patching, a "Security Constitution" for finding cloud design flaws), Azure API Connections cross-tenant bugs worth $200,000, and a test of 14 LLMs given AWS keys. It also covers a paper on malicious LLM API routers (9 of 428 injecting code) and Datadog's "counterfeit policy" bypass of the Jev classifier.

AzureAWSLLM+3
PHP2Shellprompt injectionpath traversal+9

AI Security, Cloud & Infra, Offensive Security· Added 30 Oct 2026, published 29 Oct 2026

x.comthread🧠 AI

🚨 AI News | TestingCatalog (@testingcatalog) on X

Mistral Large 4 ("Le Chonk") is an open-weights model from Mistral, now on Hugging Face. Per Mistral's announcement quoted in the post, it ranks #1 among open models on Cognition's FrontierCode benchmark, is aimed at agentic coding and cybersecurity, and claims better reasoning efficiency and lower inference costs. The post does not give parameter counts, license or benchmark scores.

Hugging FaceMistral
Mistral Large 4CognitionFrontierCode

models, coding-agents, evals· Added 30 Oct 2026, published 29 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Cisco Talos Incident Response Q3 2026 trends report. Phishing led initial access at 37 percent, with vishing and IT help desk impersonation to get RMM access; public-facing exploitation followed at 33 percent. Ransomware reached 27 percent of engagements (Qilin, Rhysida, Interlock, new VYPR), with EDR killers via BYOVD and WDAC. It also covers Salt Typhoon intrusions using CVE-2023-20198 and BadCandy, attacks on Claude Code credentials, and logging, MFA and secrets recommendations.

Cisco Secure EndpointMicrosoft Quick AssistWindows Defender+6
CVE-2023-20198Salt TyphoonBadCandy+10

Threat Intel, Blue Team & Detection· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

Linux kernelLinuxPHP+1
CVE-2026-46300CVE-2026-109618CVE-2026-109619+9

Threat Intel, Offensive Security· Added 30 Oct 2026, published 29 Oct 2026

securityweek.comarticle🛡️ Security

Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

SecurityWeek roundup of patches from Adobe, Veeam and Juniper Networks covering over three dozen vulnerabilities. Adobe fixed 12 flaws (eight critical in Campaign Classic), Veeam fixed nine (including a cross-tenant RCE in Backup for Microsoft 365), and Juniper fixed 18 in Session Smart Router and Conductor. None were reported exploited. Juniper said CVE-2026-109618 (PHP2Shell) affects Junos OS but is not exploitable there.

Adobe Campaign ClassicVeeam Backup & ReplicationVeeam Backup for Microsoft 365+2
CVE-2026-109618PHP2Shell

other· Published and added 29 Oct 2026

securityweek.comarticle🛡️ Security

Over 41,000 DHS Employee Records Leaked Online

A hacker using the handle Department of Peace leaked more than 41,000 US Department of Homeland Security employee records, which the hacker says came from an Okta single sign-on system. The data covers names, work emails, phone numbers, job titles, office locations and per-account system access, mostly for CBP, ICE and HSI staff plus about 1,000 CISA employees. Okta says it has no evidence of compromise. Distributed Denial of Secrets calls the dataset 'Icepick'.

Okta
Department of PeaceDistributed Denial of SecretsIcepick+8

Threat Intel, Identity & Access· Published and added 29 Oct 2026

arxiv.orgpaper🧠 AI

Turing LLM Post-Training: Calibrated Distillation and Efficient Dynamic-MoE Execution

Turing LLM post-training combines calibrated multi-teacher on-policy distillation (C-MOPD) with an execution path for dynamically routed mixture-of-experts models. C-MOPD matches each teacher on a local Top-K support with teacher-wise loss normalization and clipping. On Turing-20B-A2B it scores 0.9988 on four-domain integration, beats Qwen3-8B on math and code (85.92 vs 80.33 mean), and cuts consolidation step time from 398.7 to 139.3 seconds in a PPU profile.

Mixture of ExpertsC-MOPDon-policy distillation+1
Turing-20B-A2BarXiv

training, research· Added 31 Oct 2026, published 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

New Cisco firewall zero-day exploited to crash SSL VPN devices

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

Cisco ASACisco Firepower Threat DefenseVPN
CVE-2026-76418CVE-2025-20362CVE-2025-20333+10

Threat Intel, Cloud & Infra· Added 30 Oct 2026, published 29 Oct 2026

Showing 60 of 1908

Show more